◇ OpenCyber Academy
Engineering · Chapter 3 · English

Chapter 3 — Physics for computing

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Physics for computing

Lesson map

Lesson 03 published. Map, example, EX007.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Signals, noise and sampling"]
  N2["3.2 Physical shifts versus attacks"]
  N3["3.3 Energy, heat and side channels"]
  N4["3.4 Specifying physical test conditions"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX007"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Signals, noise and sampling"]
  N2["3.2 Physical shifts versus attacks"]
  N3["3.3 Energy, heat and side channels"]
  N4["3.4 Specifying physical test conditions"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX007"]

[Learning outcomes]
    |
    v
[3.1 Signals, noise and sampling]
    |
    v
[3.2 Physical shifts versus attacks]
    |
    v
[3.3 Energy, heat and side channels]
    |
    v
[3.4 Specifying physical test conditions]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX007]

Learning outcomes

You will (1) relate signals, noise and sampling to sensor and camera inputs; (2) explain how physical conditions (light, vibration, temperature) shift model inputs; (3) describe physical-world adversarial attacks and sensor spoofing at a conceptual level; and (4) specify physical test conditions for an AI component.

3.1 Signals, noise and sampling

Sensors convert physical quantities into numbers. Every measurement contains noise; sampling turns continuous signals into discrete ones, and sampling below twice the highest frequency (the Nyquist rate) causes aliasing. Cameras integrate light over exposure time; motion blur, glare and low light all change pixel values. A vision model trained on clear daytime images may meet very different inputs at night or in rain.

For TrackEye, sampling also applies to time: a camera capturing frames too slowly for the train's speed may miss a short defect entirely between frames. Engineers check that frame rate and exposure time suit the highest operating speed, not just an average run.

3.2 Physical shifts versus attacks

Natural distribution shift comes from physics: dust on lenses, temperature drift in thermistors, vibration. Adversarial physical attacks deliberately craft objects or signals: printed patterns that cause misclassification or injected signals that spoof sensors. Research has shown that perturbations can survive printing and camera capture under varied viewing conditions when optimised over many transformations. Both kinds of shift must be tested; the engineering difference is that adversaries search for the worst case while nature samples typical cases.

The test plan treats them differently: natural shifts are measured as average performance across expected conditions, while adversarial ones are measured as the worst result an attacker could find within stated limits.

3.3 Energy, heat and side channels

Computation consumes power and emits heat and electromagnetic signals that can leak information (side channels). For AI accelerators, timing and power measurements have been studied as ways to infer model properties. Physical access therefore belongs in the threat model of edge AI devices like an inspection-train computer.

An inspection-train computer travels the network and may be serviced in depots by contractors, so someone could attach measuring equipment without much difficulty. Engineers do not usually defend against every side channel, but they record which ones are plausible given who has physical access, and they protect the most valuable assets, such as model weights and signing keys, with tamper-evident enclosures and encrypted storage.

3.4 Specifying physical test conditions

An engineering specification lists conditions: illumination range (lux), temperature range, vibration spectrum, lens contamination levels, and train speed. Each becomes a test axis. For security, add adversarial conditions within the threat model — for example, "an attacker can place markings on sleepers but cannot access the train".

Each axis needs a stated range and how it will be produced in testing: recorded runs, controlled lighting rigs or simulation. Ranges come from operating data, such as the lowest light measured on dawn runs and the highest line speed. A threat-model sentence that says what the attacker cannot do is as important as what they can, because it defines when a failure counts as a security finding rather than a limitation.

3.5 Worked example (synthetic NRS case)

TrackEye's false-negative rate rose from 2% to 9% on dawn runs. Sam traced it to low sun angle causing glare at 60–80 km/h. The fix combined a polarising filter, an exposure change and 4,000 additional dawn images. Sam also added a test axis for deliberate markings near rails, since anyone walking the line could place them.

The rise from 2% to 9% only appeared when results were split by time of day; the overall average hid it. The fix combines physical and data measures, and only a retest on fresh dawn runs can show whether it worked.

3.6 Errors and limits

Laboratory lighting is even and stable, so a model that passes there has not met glare, rain or dirty lenses. Treating every failure as an attack wastes effort on threat hunting, while treating every failure as natural can hide deliberate tampering. Edge devices are often reachable by people with legitimate depot access, so physical access is a realistic path, not an exotic one, and leaving it out makes the threat model look safer than the system is.

Exercises

Synthesis

Physics determines what inputs an AI component actually receives. Engineers specify physical conditions, test natural shifts and include physical adversaries in the threat model.

Continue studying — chapter 03 of 50

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →